Score a business continuity programme on plan coverage, exercising, achievable recovery against the MTPD, alternate capacity and supplier contingency.
Recovery capability carries the largest weight and is measured against the MTPD rather than against the RTO in the policy, because the tolerable period is a business constraint while the objective is an aspiration. Exercise coverage is weighted equally with plan coverage on the simple grounds that an unexercised plan has never been shown to work, and cross-training appears because continuity plans routinely name one person who is on holiday. Continuity programmes look healthy on a plan count and fail on the two things nobody measures: whether recovery has ever been demonstrated, and whether anyone other than the author can execute the plan. These are management estimates for programme steering, not an ISO 22301 audit result.
Business Continuity
Programme score = 0.25 × recovery capability + 0.20 × plan coverage + 0.20 × exercise coverage + 0.12 × alternate capacity + 0.10 × supplier contingency + 0.08 × cross-training + 0.05 × exercise depth.
Programme score = 0.25 × recovery capability + 0.20 × plan coverage + 0.20 × exercise coverage + 0.12 × alternate capacity + 0.10 × supplier contingency + 0.08 × cross-training + 0.05 × exercise depth. Recovery capability carries the largest weight and is measured against the MTPD rather than against the RTO in the policy, because the tolerable period is a business constraint while the objective is an aspiration. Exercise coverage is weighted equally with plan coverage on the simple grounds that an unexercised plan has never been shown to work, and cross-training appears because continuity plans routinely name one person who is on holiday.
Continuity programmes look healthy on a plan count and fail on the two things nobody measures: whether recovery has ever been demonstrated, and whether anyone other than the author can execute the plan. These are management estimates for programme steering, not an ISO 22301 audit result.
This calculator takes 9 inputs: Critical business processes, Processes with a current documented plan, Processes exercised in the last 12 months, Shortest maximum tolerable period of disruption, Recovery time you can actually demonstrate, Alternate site or region capacity, Key roles with a trained deputy, Critical suppliers with a contingency arrangement, Most demanding exercise completed. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because the RTO is a target you chose and the MTPD is a limit the business imposes. If demonstrated recovery beats the RTO but breaches the MTPD, the RTO was set wrong; if it beats the MTPD but misses the RTO, you have a tuning problem rather than a survival problem.
It is far better than nothing and it is where most gaps in decision-making and communication surface cheaply. What it cannot tell you is whether the technical recovery works, which is why exercise depth is scored separately and a live failover scores highest.